Privacy on Public Wi-Fi: What you should actually worry about

Public Wi-Fi is convenient, widely available, and often necessary. Airports, hotels, cafés, libraries, universities, and coworking spaces all rely on it to keep people connected. However, public networks also have a reputation for being dangerous.

Some of that reputation is justified. Public Wi-Fi can expose users to fake hotspots, malicious networks, unwanted device discovery, tracking, and poorly secured services. But some common warnings are outdated or exaggerated. Connecting to an open wireless network does not automatically mean that someone can read every password you enter or access every file on your device.

The real risks are more nuanced. Understanding them is more useful than treating all public Wi-Fi as inherently hostile.

The Network may not be what you think

One of the most common threats is the fake hotspot, sometimes called an “evil twin.” An attacker creates a wireless network with a name that resembles a legitimate one, such as “Airport Free WiFi” or the name of a nearby hotel. The signal may be stronger than the real network, causing devices to connect automatically or encouraging users to select it manually.

Once connected, the attacker may be able to observe connection metadata, redirect users to fraudulent websites, interfere with unencrypted traffic, or present a convincing fake captive portal. The goal may be to steal credentials, distribute malware, collect personal information, or simply monitor activity.

The network name alone provides no meaningful proof of legitimacy. Even a password-protected network is not necessarily trustworthy. A password shared publicly does not provide strong security against the person operating the network. WPA2 or WPA3 protects the wireless connection between your device and the access point, but it does not guarantee that the access point itself is honest.

This is an important distinction: encryption can protect the connection from other people nearby, but it cannot make an untrusted network operator trustworthy.

HTTPS still matters more than the Wi-Fi Network

Modern HTTPS has significantly reduced the danger of ordinary network eavesdropping. When you visit a properly configured HTTPS website, the contents of the connection are encrypted between your browser and the website. Someone operating the Wi-Fi network should not be able to read your password, private messages, or page contents merely by observing the connection.

HTTPS also helps prevent attackers from silently modifying websites in transit. Browsers warn users when certificates are invalid or when a website falls back to an insecure connection, although users can still be tricked into ignoring warnings or entering information into a fraudulent site.

HTTPS is not a complete privacy solution. The network may still be able to observe metadata, including the fact that your device is communicating with a particular service, the timing and volume of traffic, and sometimes the domain being accessed. Encrypted DNS can reduce exposure of DNS queries, but it does not conceal all traffic patterns.

There is also a difference between visiting a legitimate HTTPS website and visiting a fake HTTPS website. Attackers can obtain valid certificates for domains they control. The padlock confirms that your connection is encrypted to that domain; it does not confirm that the domain is the company, service, or login page you intended to visit.

Always check the domain name, particularly before entering credentials, payment information, or recovery codes.

Captive Portals are a frequent Weak-Point

Public networks often use captive portals that require users to accept terms, enter an email address, provide a room number, or sign in before accessing the internet. These portals are not automatically malicious, but they create additional opportunities for deception.

A fake network can present a fake captive portal designed to collect credentials or personal information. Even a legitimate portal may use excessive tracking, retain identifying information, or require more data than is necessary to provide access.

Avoid entering passwords that you use elsewhere into a public Wi-Fi login page. If a portal asks for an email address, consider whether the service genuinely needs it. Privacy-conscious users may also want to use a separate email alias rather than their primary address.

If the portal behaves strangely, redirects repeatedly, displays certificate warnings, or asks for sensitive information unrelated to network access, disconnect.

Device Sharing and Local Network Attacks

Public Wi-Fi becomes more dangerous when devices expose services to the local network. File sharing, printer sharing, remote administration, network discovery, and development servers can make a device visible to other users nearby.

This does not mean that every person on the network can immediately take control of your computer. Modern operating systems usually include firewalls and other protections. However, unnecessary network services increase the attack surface, especially when software is outdated or misconfigured.

Before joining a public network, disable network discovery and file sharing where possible. Set the connection type to “public” rather than “private” or “trusted.” Make sure your operating system, browser, VPN client, and other network-facing software are updated.

The same advice applies to phones and tablets. Personal hotspots, wireless file transfer tools, local web servers, and remote-control applications can expose services that you may have forgotten were enabled.

Automatic Connections create unnecessary Risk

Many devices remember previously used wireless networks and automatically reconnect when they see a matching name. This is convenient, but it can be abused. An attacker can broadcast the name of a network your device has used before and encourage it to connect without asking.

Modern operating systems have improved their handling of saved networks, but automatic connection remains an avoidable risk. Remove old public networks from your device and disable automatic joining for networks you do not fully trust.

Bluetooth can also reveal information about nearby devices or permit unwanted pairing attempts, although Bluetooth attacks generally require specific vulnerabilities or user interaction. Disabling Bluetooth when it is not needed reduces unnecessary exposure and makes your device less discoverable.

What a VPN does and does not do

A VPN is useful on public Wi-Fi because it creates an encrypted tunnel between your device and a VPN server. This can prevent the local network operator from inspecting the contents of your traffic and can reduce exposure of DNS requests and connection destinations, depending on the VPN protocol and configuration.

However, a VPN does not make you anonymous. The VPN provider can typically see that your device connected to its service and may be able to observe connection metadata. Websites can still identify you through account logins, cookies, browser fingerprinting, tracking scripts, and other techniques.

A VPN also cannot protect you from phishing, malware, malicious browser extensions, weak passwords, compromised accounts, or voluntarily giving information to a fake website. If you connect to an evil twin and then establish a VPN tunnel to your trusted provider, the local network may have less visibility into your traffic, but it can still disrupt the connection, block the VPN, or attempt to trick you before the tunnel is established.

Use a VPN as one layer of protection, not as a substitute for HTTPS, software updates, careful browsing, and strong account security. Prefer a reputable provider with clear technical documentation, transparent data-handling practices, and modern protocols such as WireGuard or well-configured OpenVPN.

The most practical Approach

The safest way to use public Wi-Fi is to reduce trust in the network while keeping your own device well secured. Confirm the network name with staff when possible, but do not treat staff confirmation as a cryptographic guarantee. Disable automatic joining, use HTTPS, avoid sensitive actions on suspicious captive portals, and keep file sharing and network discovery turned off.

For especially sensitive activity, use mobile data or a personal hotspot instead. Cellular networks are not magically private, but they remove many local-network risks associated with unknown wireless users and rogue access points.

But remember: Public Wi-Fi is not automatically unsafe, and avoiding it entirely is not realistic for many people. The better approach is to understand what the network can observe, what encryption protects, and where your own device or behavior remains the greater risk.

The key lesson is simply to not trust the Wi-Fi network but not panic about it either. Secure protocols, sensible device settings, careful authentication practices, and a well-chosen VPN can make public connectivity considerably safer without creating a false sense of anonymity.